# CVE-2026-120323: samanhappy MCPHub passthroughHeaders.ts information disclosure

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- samanhappy / MCPHub: 1.0.0 (affected); 1.0.1 (affected); 1.0.2 (affected); 1.0.3 (affected); 1.0.4 (affected); 1.0.5 (affected); 1.0.6 (affected); 1.0.7 (affected); 1.0.8 (affected); 1.0.9 (affected); 1.0.10 (affected); 1.0.11 (affected); 1.0.12 (affected); 1.0.13 (affected); 1.0.14 (affected); 1.0.15 (affected); 1.0.16 (affected); 1.0.17 (affected); 1.0.18 (affected); 1.0.19 (affected); 1.0.20 (affected); 1.0.21 (affected); 1.0.22 (affected); 1.0.23 (affected); 1.0.24 (affected); 1.0.25 (affected); 1.0.26 (affected); 1.0.27 (affected); 1.0.28 (affected); 1.0.29 (affected); 1.0.30 (affected); 1.0.31 (affected); 1.0.32 (affected); 1.0.33 (affected); 1.0.34 (affected); 1.0.35 (affected); 1.0.36 (affected); 1.0.37 (affected); 1.0.38 (affected); 1.0.39 (affected); 1.0.40 (affected); 1.0.41 (affected); 1.0.42 (affected); 1.0.43 (affected); 1.0.44 (affected); 1.0.45 (affected); 1.1.0 (affected); 1.1.1 (affected); 1.1.2 (affected); 1.1.3 (affected); 1.1.4 (affected); 1.1.5 (affected); 1.1.6 (affected); 1.1.7 (affected); 1.1.8 (unaffected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 5.3 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X; source: CNA: VulDB

- CVSS 3.1: 4.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C; source: CNA: VulDB

- CVSS 3.0: 4.3 (medium); CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C; source: CNA: VulDB

- CVSS 2.0: 5 (medium); AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C; source: CNA: VulDB

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-200, CWE-284

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://vuldb.com/vuln/429655 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/429655/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-120323 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/1015029 (CNA: VulDB; third-party-advisory)

- https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md (CNA: VulDB; related)

- https://github.com/samanhappy/mcphub/commit/040f7b9ae004070bdfe5084cde6bc2c609f78e76 (CNA: VulDB; patch)

- https://github.com/samanhappy/mcphub/releases/tag/v1.1.8 (CNA: VulDB; patch)

- https://github.com/samanhappy/mcphub/ (CNA: VulDB; product)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-120323; retrieved 2026-11-02; source updated 2026-11-02

Revision: 43c761636984f1f1845fd9937259abc4ce6583957faf14771fffcd03ecdf3d27

Canonical: https://y2.dev/cve/CVE-2026-120323